AMENDMENTS TO THE CLAIMS 



1 . (Currently Amended) A method for grouping log file entries by session, 
comprising: 

storing a log file of entries in a memory, each of said entries identifying a client request 
to a server; 

retrieving a subset of log file entries from the memory; 

processing [[ identifying ]] each entry in the memory to identify entries in the subset of log 

file entries that belong to a complete client session; 
grouping entries in the subset that belong to a complete client session. 

2. (Original) The method of claim 1, wherein a complete client session is 
identified by identifying all entries in the subset that arc associated with a particular client 
session and that include both a beginning entry and an end entry. 

3. (Original) The method of claim 2, wherein an end entry is identified as any 
entry that corresponds to a logout request. 

4. (Original) The method of claim 2, wherein an end entry for a client session is 
identified as any entry associated with that client session that has no other entries for that client 
session that occur within a session expiration window. 

5. (Original) The method of claim 2, wherein an end entry for a client session is 
identified as any entry having a first timestamp value, where the difference between first 
timestamp value and a second timestamp value associated with a subsequent entry in the subset 
of log files exceeds a timeout value. 

6. (Original) The method of claim 1, further comprising outputting all entries in 
the subset of log file entries that do not belong to a complete client session as raw log data. 
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7. (Original) The method of claim 1, further comprising outputting as raw log 
data all entries in the subset of log file entries that belong to an incomplete client session which 
has a beginning entry but no end entry. 

8. (Original) An article of manufacture having at least one recordable medium 
having stored thereon executable instructions and data which, when executed by at least one 
processing device, cause the at least one processing device to: 

read a plurality of records from a file system into a ring buffer, where said plurality or 
records comprises a subset of all records in the file system; 

scan each record in the ring buffer to identify a user session for said record and to 
identify any start or end records in the ring buffer; 

allocate, for each identified user session, an index to identify all records in the ring buffer 
that are associated with the identified user session and to identify all start or end records; and 

process the index to group all records in the ring buffer belonging to a complete user 
session, to output the grouped records for further analysis. 

9. (Original) The article of manufacture of claim 8, wherein the index 
comprises: 

a session record for each identified user session for keying into the ring buffer to identify 
log records associated with said identified user session; 

a hash table for keying into the session record based upon session key information; 
a linked listing of last seen log records for each session; and 
a linked list of first seen log records for each session. 

10. (Original) The article of manufacture of claim 8, wherein the ring buffer 
implements a sliding window to process all of the log records in the file system into complete 
user sessions by sequentially adding and removing log records to the ring buffer until all of the 
log records in the file system have been processed. 
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1 1 . (Currently Amended) A system for session-based processing of log files using a 
data processing system and network session data collected from one or more users, the system 
comprising: 

a log file collection system for collecting a plurality of server request entries, wherein a 

server request entry comprises a session identifier; and 
a processing engine to process [[ at least ]] a subset of the plurality of server request 

entries to group the server request entries by session using the session identifier in 

each server request entry. 

12. (Original) The system of claim 1 1 , wherein the processing engine uses a 
plurality of data structures to group the web server request entries by session, said plurality of 
data structures comprising: 

a ring buffer for storing the subset of the plurality of web server request entries, 
a per-session record for keying into the ring buffer 
a hash table for keying into the per-session records 

a linked list of last processed web server request entries for each session, and 
a linked list of first processed web server request entries for each session. 

13. (Original) The system of claim 1 1 , wherein the processing engine uses a 
sliding memory window to process the subset of the plurality of web server request entries. 

14. (Original) The system of claim 1 1 , further comprising a parser for further 
analysis the web server request entries that have been grouped by session to generate a user 
session history. 

1 5 . (Original) The system of claim 1 1 , where the processing engine generates an 
output file containing web server request entries corresponding to one or more complete user 
sessions. 
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16. (Original) The system of claim 11, where the processing engine generates an 
output file containing web server request entries corresponding to one or more incomplete user 
sessions. 

17. (Original) The system of claim 11, where the processing engine generates an 
output file containing web server request entries corresponding to one or more user sessions that 
do not include an end session entry. 

18. (Original) A system for parsing web site logs one session at a time, 
comprising: 

means for storing network session data from at least one server log file; 
means for reading a subset of the network session data; 

means for processing the subset of the network session data to group said network session 
data by session; 

means for generating a first output file containing network session data grouped by 
session; and 

means for parsing said first output file. 

19. (Original) The system of claim 1 8, wherein the means for reading a subset of 
the network session data comprises a sliding window. 

20. (Original) The system of claim 18, wherein the means for reading a subset of 
the network session data comprises a ring buffer. 
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